Live thumbnails refresh ~every 1.5s · NVR password stays server-side · no plugin, works on iPhone.
⚠ The NVR web port is still open to the internet (that's how this reaches the cameras). Closing it via a Cloudflare Tunnel is the next security step — the feed keeps working.